Changelog entry
Public feed/profile access contract hardening
2026-03-10
- Cleaned up duplicate middleware public-route matching for `/nations/[id]/public` so guest-access behavior stays consistent.
- Added contract coverage to keep `/api/public/events` anonymous and world-explicit (including configured default-world fallback when `worldId` is omitted).